CVE-2026-22574: FortiSOAR Information Disclosure Flaw

CVE-2026-22574 Overview

A storing passwords in a recoverable format vulnerability has been identified in Fortinet FortiSOAR PaaS and on-premise deployments. This security flaw allows an authenticated remote attacker with high privileges to retrieve Service account passwords through server address modification in LDAP configuration settings. The vulnerability stems from insecure password storage practices (CWE-257) that enable password recovery rather than secure one-way hashing.

Critical Impact

Authenticated attackers with administrative privileges can extract sensitive Service account credentials by manipulating LDAP server configurations, potentially leading to lateral movement and broader infrastructure compromise.

Affected Products

• FortiSOAR PaaS 7.6.0 through 7.6.4
• FortiSOAR PaaS 7.5.0 through 7.5.2
• FortiSOAR PaaS 7.4 all versions
• FortiSOAR PaaS 7.3 all versions
• FortiSOAR on-premise 7.6.0 through 7.6.4
• FortiSOAR on-premise 7.5.0 through 7.5.2
• FortiSOAR on-premise 7.4 all versions
• FortiSOAR on-premise 7.3 all versions

Discovery Timeline

• 2026-04-14 - CVE-2026-22574 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-22574

Vulnerability Analysis

This vulnerability falls under CWE-257 (Storing Passwords in a Recoverable Format), which represents a significant deviation from secure credential management best practices. The core issue lies in how FortiSOAR stores Service account credentials used for LDAP authentication. Instead of employing secure one-way cryptographic hashing, the system stores passwords in a format that permits recovery.

An authenticated attacker with elevated privileges can exploit this flaw by modifying the LDAP server address configuration within FortiSOAR. By redirecting LDAP queries to an attacker-controlled server, the attacker can intercept the authentication attempt and capture the plaintext Service account credentials as they are transmitted.

The network-based attack vector requires no user interaction but does require the attacker to possess high-level privileges within the FortiSOAR environment. The scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component itself, as compromised Service account credentials could provide access to other systems in the environment.

Root Cause

The root cause of CVE-2026-22574 is the improper implementation of password storage mechanisms within FortiSOAR's LDAP integration module. Passwords are stored using reversible encryption rather than secure one-way hashing algorithms. This design choice, while potentially enabling certain functionality like credential retrieval for service connections, violates fundamental security principles that mandate passwords should never be stored in a recoverable format.

Attack Vector

The attack exploits the LDAP configuration interface within FortiSOAR. An authenticated administrator can modify the LDAP server address to point to a malicious server under their control. When FortiSOAR subsequently attempts to authenticate against the modified LDAP endpoint, it transmits the Service account credentials, which the attacker captures on their rogue server.

The attack chain involves:

1. Attacker gains authenticated access to FortiSOAR with administrative privileges
2. Attacker navigates to LDAP configuration settings
3. Attacker modifies the LDAP server address to point to an attacker-controlled system
4. FortiSOAR attempts authentication using stored Service account credentials
5. Attacker intercepts and captures the credentials on their rogue server

For detailed technical information, refer to the Fortinet PSIRT Advisory FG-IR-26-105.

Detection Methods for CVE-2026-22574

Indicators of Compromise

• Unexpected modifications to LDAP server configuration settings within FortiSOAR
• LDAP connection attempts to unfamiliar or suspicious IP addresses
• Administrative configuration changes outside normal maintenance windows
• Audit log entries showing LDAP settings modifications by unexpected users

Detection Strategies

• Enable and monitor FortiSOAR audit logs for any changes to LDAP configuration parameters
• Implement network monitoring to detect LDAP traffic directed to non-approved destination servers
• Deploy change management controls that alert on modifications to authentication-related configurations
• Use SentinelOne Singularity platform to monitor for suspicious administrative actions and credential harvesting activities

Monitoring Recommendations

• Configure alerts for any modification to LDAP server addresses in FortiSOAR
• Monitor outbound LDAP traffic (ports 389/636) from FortiSOAR instances to unauthorized destinations
• Review administrative access patterns for anomalous behavior indicating potential insider threats
• Implement network segmentation monitoring to detect lateral movement using compromised credentials

How to Mitigate CVE-2026-22574

Immediate Actions Required

• Review and audit current LDAP configuration settings in all FortiSOAR deployments
• Verify LDAP server addresses point to legitimate, authorized directory servers only
• Implement strict access controls limiting which administrators can modify LDAP settings
• Rotate Service account credentials used for LDAP authentication as a precautionary measure
• Apply available security patches from Fortinet as soon as possible

Patch Information

Fortinet has published security guidance for this vulnerability. Administrators should consult the Fortinet PSIRT Advisory FG-IR-26-105 for specific patch availability and upgrade instructions. Organizations running affected versions (7.3.x, 7.4.x, 7.5.0 through 7.5.2, and 7.6.0 through 7.6.4) should prioritize patching based on their risk assessment.

Workarounds

• Implement network-level restrictions to prevent FortiSOAR from initiating LDAP connections to unauthorized servers
• Configure firewall rules to allow LDAP traffic only to known, legitimate directory server IP addresses
• Enable multi-factor authentication for administrative access to FortiSOAR configuration interfaces
• Implement separation of duties to require multiple approvals for LDAP configuration changes

# Example firewall configuration to restrict LDAP destinations
# Only allow FortiSOAR to connect to approved LDAP servers
iptables -A OUTPUT -p tcp --dport 389 -d <approved_ldap_server_ip> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 636 -d <approved_ldap_server_ip> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 389 -j DROP
iptables -A OUTPUT -p tcp --dport 636 -j DROP